John Stultz
a4f8f6667f
timekeeping: Cap array access in timekeeping_debug ...
It was reported that hibernation could fail on the 2nd attempt, where the
system hangs at hibernate() -> syscore_resume() -> i8237A_resume() ->
claim_dma_lock(), because the lock has already been taken.
However there is actually no other process would like to grab this lock on
that problematic platform.
Further investigation showed that the problem is triggered by setting
/sys/power/pm_trace to 1 before the 1st hibernation.
Since once pm_trace is enabled, the rtc becomes unmeaningful after suspend,
and meanwhile some BIOSes would like to adjust the 'invalid' RTC (e.g, smaller
than 1970) to the release date of that motherboard during POST stage, thus
after resumed, it may seem that the system had a significant long sleep time
which is a completely meaningless value.
Then in timekeeping_resume -> tk_debug_account_sleep_time, if the bit31 of the
sleep time happened to be set to 1, fls() returns 32 and we add 1 to
sleep_time_bin[32], which causes an out of bounds array access and therefor
memory being overwritten.
As depicted by System.map:
0xffffffff81c9d080 b sleep_time_bin
0xffffffff81c9d100 B dma_spin_lock
the dma_spin_lock.val is set to 1, which caused this problem.
This patch adds a sanity check in tk_debug_account_sleep_time()
to ensure we don't index past the sleep_time_bin array.
[jstultz: Problem diagnosed and original patch by Chen Yu, I've solved the
issue slightly differently, but borrowed his excelent explanation of the
issue here.]
Fixes: 5c83545f24linux-pm@vger.kernel.org
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Xunlei Pang <xpang@redhat.com>
Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
Cc: stable <stable@vger.kernel.org>
Cc: Zhang Rui <rui.zhang@intel.com>
Link: http://lkml.kernel.org/r/1471993702-29148-3-git-send-email-john.stultz@linaro.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2016-08-24 09:34:32 +02:00
bpf: fix bpf_skb_in_cgroup helper naming
2016-08-12 21:53:33 -07:00
config: add android config fragments
2016-08-02 19:35:42 -04:00
mm/init: Add 'rodata=off' boot cmdline parameter to disable read-only kernel mappings
2016-02-22 08:51:37 +01:00
perf/core: Check return value of the perf_event_read() IPI
2016-08-18 10:35:52 +02:00
gcov: add support for gcc version >= 6
2016-07-15 14:54:27 +09:00
genirq/msi: Make sure PCI MSIs are activated early
2016-08-09 09:19:32 +02:00
modules: add ro_after_init support
2016-08-04 10:16:55 +09:30
locking/pvqspinlock: Fix a bug in qstat_read()
2016-08-10 14:13:29 +02:00
Merge branch 'pm-sleep'
2016-08-18 03:27:08 +02:00
Revert "printk: create pr_<level> functions"
2016-08-09 10:48:18 -07:00
Merge branch 'smp-hotplug-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2016-07-29 13:55:30 -07:00
sched/cputime: Resync steal time when guest & host lose sync
2016-08-18 11:19:48 +02:00
timekeeping: Cap array access in timekeeping_debug
2016-08-24 09:34:32 +02:00
block: rename bio bi_rw to bi_opf
2016-08-07 14:41:02 -06:00
Merge branch 'stable-4.8' of git://git.infradead.org/users/pcmoore/audit
2016-07-29 17:54:17 -07:00
Merge branch 'stable-4.8' of git://git.infradead.org/users/pcmoore/audit
2016-07-29 17:54:17 -07:00
wrappers for ->i_mutex access
2016-01-22 18:04:28 -05:00
audit: cleanup prune_tree_thread
2016-04-04 09:46:47 -04:00
don't bother with ->d_inode->i_sb - it's always equal to ->d_sb
2016-04-10 17:11:51 -04:00
audit: add fields to exclude filter by reusing user filter
2016-06-27 11:01:00 -04:00
Merge branch 'stable-4.8' of git://git.infradead.org/users/pcmoore/audit
2016-07-29 17:54:17 -07:00
kernel: Add noaudit variant of ns_capable()
2016-06-06 20:16:18 +10:00
Merge branch 'for-4.7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2016-07-29 14:29:04 -07:00
cgroup: Use lld instead of ld when printing pids controller events_limit
2016-06-21 15:03:36 -04:00
timers/core: Correct callback order during CPU hot plug
2016-07-28 18:56:22 +02:00
cpuset, mm: fix TIF_MEMDIE check in cpuset_change_task_nodemask
2016-07-28 16:07:41 -07:00
cred: Reject inodes with invalid ids in set_create_file_as()
2016-06-30 18:05:09 -05:00
kmemcg: account certain kmem allocations to memcg
2016-01-14 16:00:49 -08:00
kernel/exit.c: quieten greatest stack depth printk
2016-08-02 19:35:23 -04:00
mm: fix memcg stack accounting for sub-page stacks
2016-07-28 16:07:41 -07:00
freezer, oom: check TIF_MEMDIE on the correct task
2016-07-28 16:07:41 -07:00
futex: Assume all mappings are private on !MMU systems
2016-07-29 18:44:14 +02:00
ptrace: use fsuid, fsgid, effective creds for fs access checks
2016-01-20 17:09:18 -08:00
kernel/hung_task.c: use timeout diff when timeout is updated
2016-03-22 15:36:02 -07:00
powerpc updates for 4.8 #2
2016-08-05 09:00:54 -04:00
kallsyms: add support for relative offsets in kallsyms address table
2016-03-15 16:55:16 -07:00
ptrace: use fsuid, fsgid, effective creds for fs access checks
2016-01-20 17:09:18 -08:00
kernel/kcov: unproxify debugfs file's fops
2016-06-15 04:56:35 -07:00
kexec: allow architectures to override boot mapping
2016-08-02 19:35:27 -04:00
kexec: add restriction on kexec_load() segment sizes
2016-08-02 19:35:31 -04:00
kexec: introduce a protection mechanism for the crashkernel reserved memory
2016-05-23 17:04:14 -07:00
kexec: move some memembers and definitions within the scope of CONFIG_KEXEC_FILE
2016-01-20 17:09:18 -08:00
kexec: add a kexec_crash_loaded() function
2016-08-02 19:35:30 -04:00
sched/debug: Make schedstats a runtime tunable that is disabled by default
2016-02-09 11:54:23 +01:00
ELF/MIPS build fix
2016-05-23 17:04:14 -07:00
libnvdimm for 4.8
2016-07-28 17:38:16 -07:00
Removed the MODULE_SIG_FORCE-means-no-MODULE_FORCE_LOAD patch.
2016-08-04 09:14:38 -04:00
KEYS: Move the point of trust determination to __key_link()
2016-04-11 22:43:43 +01:00
cgroup: introduce cgroup namespaces
2016-02-16 13:04:58 -05:00
kernel/padata.c: hide unused functions
2016-05-19 19:12:14 -07:00
kexec: use core_param for crash_kexec_post_notifiers boot option
2016-08-02 19:35:29 -04:00
remove lots of IS_ERR_VALUE abuses
2016-05-27 15:26:11 -07:00
profile: Convert to hotplug state machine
2016-07-15 10:41:42 +02:00
tree-wide: replace config_enabled() with IS_ENABLED()
2016-08-04 08:50:07 -04:00
relay: add global mode support for buffer-only channels
2016-08-02 19:35:41 -04:00
/proc/iomem: only expose physical resource addresses to privileged users
2016-04-14 12:56:09 -07:00
tree-wide: replace config_enabled() with IS_ENABLED()
2016-08-04 08:50:07 -04:00
signals: Use hrtimer for sigtimedwait()
2016-07-07 10:35:07 +02:00
Merge branch 'smp-hotplug-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2016-07-29 13:55:30 -07:00
cpu/hotplug: Unpark smpboot threads from the state machine
2016-03-01 20:36:56 +01:00
cpu/hotplug: Create hotplug threads
2016-03-01 20:36:56 +01:00
arch, ftrace: for KASAN put hard/soft IRQ entries into separate sections
2016-03-25 16:37:42 -07:00
stop_machine: Touch_nmi_watchdog() after MULTI_STOP_PREPARE
2016-07-27 11:12:11 +02:00
prctl: make PR_SET_THP_DISABLE wait for mmap_sem killable
2016-05-23 17:04:14 -07:00
printk: add kernel parameter to control writes to /dev/kmsg
2016-08-02 19:35:06 -04:00
kernel/sysctl_binary.c: use generic UUID library
2016-05-20 17:58:30 -07:00
task_work: use READ_ONCE/lockless_dereference, avoid pi_lock if !task_works
2016-08-02 19:35:02 -04:00
taskstats: use the libnl API to align nlattr on 64-bit
2016-04-23 20:13:25 -04:00
torture: Stop onoff task if there is only one cpu
2016-06-14 16:03:28 -07:00
kernel/...: convert pr_warning to pr_warn
2016-03-22 15:36:02 -07:00
time, acct: Drop irq save & restore from __acct_update_integrals()
2016-02-29 09:53:09 +01:00
fs: Limit file caps to the user namespace of the super block
2016-06-24 10:40:31 -05:00
Revert "perf/x86/intel, watchdog: Switch NMI watchdog to ref cycles on x86"
2016-07-10 20:58:36 +02:00
Merge branch 'smp-hotplug-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2016-07-29 13:55:30 -07:00
sched/core: Get rid of 'cpu' argument in wq_worker_sleeping()
2016-03-02 10:28:47 -05:00
a4f8f6667f